wafris 2.0.6 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0526847233d7c6d16c4c437e3e76027820b992e2a2973742d375b75f482d3597'
-  data.tar.gz: 39b2d2396ce30df2cd1705fe1b9716d1e8f39e41acd5efbc0d825da026c3e548
+  metadata.gz: e1efce2cd1d45e54016f741cbe2f90b99eaa1b9c13135775345a8c6c0799f9e8
+  data.tar.gz: 6b1e761814eaa0830e687b14a67862fd78b60220bc9cf79f5d7b52d0ff48b90c
 SHA512:
-  metadata.gz: 6beef692dfedb3bb7d59c78467f8203e72b1dc437f6f9c72ea1f4ef91f4bbc85fbea253a84d3225a437b3094343829c14599d4cab3a3fbcc58f56bf05542237d
-  data.tar.gz: bcea98d516104532ac58875f408969e207e221abe3658b9c0ab07f90d6132dbb0e3145d8e17c99621c702257fd7badfbd999493f86ff73429b7640268f644494
+  metadata.gz: c4ffd902c97eac5e6f93944da1b4cb8ef93a7504e4d93e0289ef117726eb8f13e8c9691001c2f7c1501d5c916ba1d40cb02aff1a055d90a07a5c56e37f19fce3
+  data.tar.gz: 56112f8a5bb85fca29a19e9ce3cd0500beb33f573caf415cd5c9f87ef1e2daee081b3da4508ede63712bed7404ff5ea1359471af90f3901164eac51bfa3ad04d

data/lib/wafris/proxy_filter.rb

@@ -1,3 +1,25 @@
+# This file includes code from the https://github.com/rack/rack project,
+# which is licensed under the MIT License.
+# Copyright (C) 2007-2021 Leah Neukirchen <http://leahneukirchen.org/infopage.html>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
 # frozen_string_literal: true
 
 module Wafris
@@ -15,6 +37,15 @@ module Wafris
         /\A172\.(1[6-9]|2[0-9]|3[01])#{valid_ipv4_octet}{2}\z/,   # private IPv4 range 172.16.0.0 .. 172.31.255.255
         /\A192\.168#{valid_ipv4_octet}{2}\z/,                     # private IPv4 range 192.168.x.x
         /\Alocalhost\z|\Aunix(\z|:)/i,                            # localhost hostname, and unix domain sockets
+        # Cloudflare IPs: https://www.cloudflare.com/en-au/ips/
+        /\A103\.21\.24[4-7]#{valid_ipv4_octet}\z/,                # 103.21.244.0/22
+        /\A103\.22\.20[0-3]#{valid_ipv4_octet}\z/,                # 103.22.200.0/22
+        /\A103\.31\.[4-7]#{valid_ipv4_octet}\z/,                  # 103.31.4.0/22
+        /\A104\.(1[6-9]|2[0-3])#{valid_ipv4_octet}{2}\z/,         # 104.16.0.0/13
+        /\A104\.2[4-7]#{valid_ipv4_octet}{2}\z/,                  # 104.24.0.0/14
+        /\A108\.162\.192#{valid_ipv4_octet}\z/,                   # 108.162.192.0/18
+        /\A162\.15[8-9]#{valid_ipv4_octet}{2}\z/,                # 162.158.0.0/15
+        /\A172\.(6[4-9]|7[0-1])#{valid_ipv4_octet}{2}\z/,         # 172.64.0.0/13
         *user_defined_proxies
       )
 

data/lib/wafris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wafris
-  VERSION = "2.0.6"
+  VERSION = "2.1.0"
 end

data/lib/wafris.rb

@@ -19,6 +19,19 @@ module Wafris
   class << self
     attr_accessor :configuration
 
+    ALLOWED_IP = "ai"
+    ALLOWED_CIDR = "ac"
+    BLOCKED_IP = "bi"
+    BLOCKED_CIDR = "bc"
+    BLOCKED_REPUTATION = "brep"
+    BLOCKED_COUNTRY = "bctry"
+    BLOCKED_USER_AGENT = "bu"
+    BLOCKED_PATH = "bp"
+    BLOCKED_PARAM = "bparam"
+    BLOCKED_HOST = "bh"
+    BLOCKED_METHOD = "bm"
+    BLOCKED_RATE_LIMIT = "brl"
+
     def configure
       self.configuration ||= Wafris::Configuration.new
       yield(configuration)
@@ -434,34 +447,35 @@ module Wafris
           SQLite3::Database.new "#{@configuration.db_file_path}/#{data_subscriptions_db_filename}"
 
         ip = request.ip
-        return queue_upsync_request(request, "Allowed", "ai", ip) if exact_match(ip, "allowed_ips", rules_db)
-        return queue_upsync_request(request, "Allowed", "ac", ip) if ip_in_cidr_range(ip, "allowed_cidr_ranges", rules_db)
-        return queue_upsync_request(request, "Blocked", "bi", ip) if exact_match(ip, "blocked_ips", rules_db)
-        return queue_upsync_request(request, "Blocked", "bc", ip) if ip_in_cidr_range(ip, "blocked_cidr_ranges", rules_db)
+
+        return queue_upsync_request(request, "Allowed", ALLOWED_IP, ip) if exact_match(ip, "allowed_ips", rules_db)
+        return queue_upsync_request(request, "Allowed", ALLOWED_CIDR, ip) if ip_in_cidr_range(ip, "allowed_cidr_ranges", rules_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_IP, ip) if exact_match(ip, "blocked_ips", rules_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_CIDR, ip) if ip_in_cidr_range(ip, "blocked_cidr_ranges", rules_db)
 
         country_code = get_country_code(ip, data_subscriptions_db)
-        return queue_upsync_request(request, "Blocked", "bs", "G_#{country_code}") if exact_match(country_code, "blocked_country_codes", rules_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_COUNTRY, "G_#{country_code}") if exact_match(country_code, "blocked_country_codes", rules_db)
 
         # Blocked Reputation IP Ranges
-        return queue_upsync_request(request, "Blocked", "bs", "R") if ip_in_cidr_range(ip, "reputation_ip_ranges", data_subscriptions_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_REPUTATION, "R") if ip_in_cidr_range(ip, "reputation_ip_ranges", data_subscriptions_db)
 
         user_agent_match = substring_match(request.user_agent, "blocked_user_agents", rules_db)
-        return queue_upsync_request(request, "Blocked", "bu", user_agent_match) if user_agent_match
+        return queue_upsync_request(request, "Blocked", BLOCKED_USER_AGENT, user_agent_match) if user_agent_match
 
         path_match = substring_match(request.path, "blocked_paths", rules_db)
-        return queue_upsync_request(request, "Blocked", "bp", path_match) if path_match
+        return queue_upsync_request(request, "Blocked", BLOCKED_PATH, path_match) if path_match
 
         parameters_match = substring_match(request.parameters, "blocked_parameters", rules_db)
-        return queue_upsync_request(request, "Blocked", "ba", parameters_match) if parameters_match
+        return queue_upsync_request(request, "Blocked", BLOCKED_PARAM, parameters_match) if parameters_match
 
-        return queue_upsync_request(request, "Blocked", "bh", request.host) if exact_match(request.host, "blocked_hosts", rules_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_HOST, request.host) if exact_match(request.host, "blocked_hosts", rules_db)
 
-        return queue_upsync_request(request, "Blocked", "bm", request.method) if exact_match(request.method, "blocked_methods", rules_db)
+        return queue_upsync_request(request, "Blocked", BLOCKED_METHOD, request.method) if exact_match(request.method, "blocked_methods", rules_db)
 
         # Rate Limiting
         rule_id = check_rate_limit(ip, request.path, request.method, rules_db)
         if rule_id
-          return queue_upsync_request(request, "Blocked", "brl", rule_id)
+          return queue_upsync_request(request, "Blocked", BLOCKED_RATE_LIMIT, rule_id)
         end
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wafris
 version: !ruby/object:Gem::Version
-  version: 2.0.6
+  version: 2.1.0
 platform: ruby
 authors:
 - Michael Buckbee
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-10-23 00:00:00.000000000 Z
+date: 2024-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack